CVE-2021-43307: Regular expression denial of service in semver-regex
Summary
CVE-2021-43307: Regular expression denial of service in semver-regex. Affects semver-regex across 2 version ranges.
< 3.1.4
>= 4.0.0, < 4.0.3
Fixed in 3.1.4 or 4.0.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The semver-regex npm package is a library used for parsing and validating semantic version numbers. It provides a regular expression pattern that can be used to match and validate version numbers in the semantic versioning format. The package is commonly used in JavaScript projects that require version number validation. However, a vulnerability has been discovered in the package that allows for a regular expression denial of service (ReDoS) attack.
Vulnerability Detail
The vulnerability in the semver-regex package allows an attacker to trigger an exponential ReDoS attack by supplying arbitrary input to the test() method. This can lead to a denial of service condition where the application becomes unresponsive or crashes due to the excessive amount of time and resources consumed by the regular expression matching process. The impact of this vulnerability is relatively low, as it requires the attacker to have the ability to supply arbitrary input to the test() method. However, it is still important to address this vulnerability to prevent potential disruption of the application.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.1.43.1.4npm install semver-regex@3.1.4 -
>= 4.0.0, < 4.0.34.0.3npm install semver-regex@4.0.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, as a general best practice, it is recommended to validate user input and sanitize it before passing it to the test() method of the semver-regex package. This can help mitigate the risk of ReDoS attacks.
Conclusion
The semver-regex package is vulnerable to a regular expression denial of service (ReDoS) attack. To mitigate this vulnerability, it is important to update the package to version 3.1.4 or later. Additionally, developers should validate and sanitize user input before passing it to the package's test() method. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for semver-regex →
FAQ
Semver-regex is an npm package used for parsing and validating semantic version numbers in JavaScript projects.
A ReDoS (Regular Expression Denial of Service) attack is a type of denial of service attack where an attacker exploits the exponential time complexity of certain regular expressions to cause a significant slowdown or crash in the target application.
The impact of this vulnerability is relatively low, as it requires the attacker to have the ability to supply arbitrary input to the test() method of the semver-regex package. However, it can still lead to a denial of service condition where the application becomes unresponsive or crashes.
To fix this vulnerability, it is recommended to update the semver-regex package to version 3.1.4 or later. This version includes a fix for the ReDoS vulnerability.
There is no specific workaround mentioned for this vulnerability. However, it is recommended to validate and sanitize user input before passing it to the test() method of the semver-regex package to mitigate the risk of ReDoS attacks.
Related vulnerabilities
Recent vulnerabilities recorded for semver-regex.
